ebfc2b62ea889cf96c4eb0b649672c6b713ad163fd5818c2f46a9b5726dd80fb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 14:46

Target

客户端/20201108/D3DX81ab.dll
Size

673KB
MD5

4d27c761c43f1f4094005889efd968eb
SHA1

3900a153f894dda7a8b23984b20d87b3ae6b01ab
SHA256

7afd418750824969fd6d0c6db949456998f792c97d6a69669051e1c90a458a5b
SHA512

5a173e16fec3555da024555c3b8ca3c95667b6f6e2286c8ab83a63a70b614effe01c7332a9f518ceb9cc6754295bbfc3fffb93e7e6ca36050a4e3a38ac48dc2e
SSDEEP

12288:g905yeX+DrR+wK/7OQQFICi7hrevXUdqzA/hz29FoVIJoLyq06:g9kOPi/ajFICi7EMdqzAB+cAo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe
PID 2292 wrote to memory of 2304	2292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\客户端\20201108\D3DX81ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\客户端\20201108\D3DX81ab.dll,#1
  2⤵
  PID:2304